North Korea operates a state-run recruitment and training program that produces cyber operators which Reuters links to the group blamed for last month’s $6.3 billion theft from the Binance cryptocurrency exchange — described as the largest cyber heist to date.
Selection and training
Selection into the program begins early: candidates are identified as young as 11–12 years old. The state reportedly selects about 200 exceptionally capable teenagers each year and places them in a strict training pipeline. Those chosen are redirected into IT education regardless of their personal wishes and, by age 17, are sent to the country's top universities. Their curriculum includes mathematics and foreign languages as well as cryptocurrency protocols and reverse-engineering of foreign hardware.
Only those who pass multiple filtering stages advance, and successful graduates are assigned to the military’s cyber warfare units. South Korean intelligence estimated in 2024 that roughly 8,400 people work in North Korea’s cyber operations sector.
Rewards and social privileges
Successful operations are rewarded handsomely by the regime: military units may retain up to 30 percent of seized funds in US dollars. Top performers can receive a metropolitan apartment of up to 132 square meters, with the option to have their parents move in. Other privileges include party membership, opportunities to marry into elite families, and foreign postings — for example to China — where they can access the internet more freely.
The state registers these specialists as “scientists” or “researchers,” a designation that, according to the reports, provides de facto protection from international law enforcement and allows them to iteratively refine their techniques.
Techniques: disguise, AI, and fabricated identities
Reports say North Korean hackers increasingly rely on artificial intelligence as a basic tool for attacks and obfuscation. They use paid accounts on services such as ChatGPT, DeepSeek, Claude Code and Cursor to write code, produce fake résumés, and create fictional identities.
The Binance breach last month has been attributed by the US Federal Bureau of Investigation (FBI) and blockchain analysts to a unit linked to the Lazarus group, identified as TraderTraitor. The operation began with a fake job interview and malware hidden in an advertisement, and the attackers then exploited Binance’s own internal AI tool to take control of systems.
Working conditions and coercion
Despite the material rewards, operatives face harsh conditions. Reports describe personnel, especially those deployed abroad, living under strict military regimes in cramped accommodations and constant surveillance. They often work more than ten hours a day and endure intense mental strain because they must meet rigid monthly dollar quotas. Those who fail to meet expectations face public shaming and severe punishments.
Even so, the trend toward targeting larger, better-protected systems continues; the successful strike against Binance illustrates that striking high-value targets can be very profitable for the Pyongyang leadership.
Sources and notes
This article is based on reporting by Reuters. An AI assistant contributed to preparing the piece; final content was edited and verified by our journalist.
